PKCS #10 Certificate-Signing Request (CSR)

Abstract

There is another cryptographic structure similar to the X.509 certificate called the PKCS #10 Certificate Signing Request (CSR). This is used to submit a public key and information to construct a Subject Distinguished Name to a Registration Authority (RA) to request creation of an X.509 digital certificate. The RA must validate all information submitted in the CSR before passing the request on to the Certification Authority (CA), who actually creates the certificate and digitally signs it. To prevent fraud, the CSR is digitally signed using the private key associated with the submitted public key. Once the CSR has been submitted, there is no need to keep it around (you can actually create a new CSR from any existing digital certificate for renewal or replacement purposes).